The same thing happened to us last pay period.  Someone hacked into payroll and changed a former employee to active and changed the pay type to direct deposit and QB paid it without verifying any information or that we had an authorization from the employee to do so.  We have all the security in place that we can possibly have.  I feel like QB is not monitoring on their end as much as they should be.  We stopped payment at our bank and now QB says if they can't get the money back then WE owe it back to QB because they paid it on our behalf!   I had to go through several different phone calls to even get to the fraud department and still have not talked to a real person!  I am still waiting on an email or a phone call.  No they do not have your back!  I have several contradictory emails from the "QB team." QB Support is not very "Supportive" at all given the amount of money we pay each month!